DVA-C02 · Question #385
A company hosts its application in the us-west-1 Region. The company wants to add redundancy in the us-east-1 Region. The application secrets are stored in AWS Secrets Manager in us-west-1. A…
The correct answer is A. Configure secret replication for each secret. Add us-east-1 as a replication Region. Choose an. AWS Secrets Manager natively supports cross-Region secret replication, allowing a primary secret to be replicated to one or more additional Regions from the source Region's configuration.
Question
A company hosts its application in the us-west-1 Region. The company wants to add redundancy in the us-east-1 Region. The application secrets are stored in AWS Secrets Manager in us-west-1. A developer needs to replicate the secrets to us-east-1. Which solution will meet this requirement?
Options
- AConfigure secret replication for each secret. Add us-east-1 as a replication Region. Choose an
- BCreate a new secret in us-east-1 for each secret. Configure secret replication in us-east-1. Set
- CCreate a replication rule for each secret. Set us-east-1 as the destination Region. Configure the
- DCreate a Secrets Manager lifecycle rule to replicate each secret to a new Amazon S3 bucket in
How the community answered
(25 responses)- A92% (23)
- C4% (1)
- D4% (1)
Why each option
AWS Secrets Manager natively supports cross-Region secret replication, allowing a primary secret to be replicated to one or more additional Regions from the source Region's configuration.
In AWS Secrets Manager, you configure replication directly on the existing primary secret by adding a replication Region (us-east-1). Secrets Manager then automatically keeps the replica in sync with the primary, meeting the redundancy requirement with no additional infrastructure.
Replication must be configured on the primary (source) secret in us-west-1, not by creating a new independent secret in the destination Region; there is no inbound replication configuration in the destination Region.
AWS Secrets Manager does not have a 'replication rule' concept; replication is configured as an attribute of the primary secret itself.
AWS Secrets Manager does not have lifecycle rules, and secrets are not replicated to Amazon S3; S3 is object storage and not a substitute for Secrets Manager's secret management and rotation features.
Concept tested: Secrets Manager cross-Region secret replication
Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/create-manage-multi-region-secrets.html
Community Discussion
No community discussion yet for this question.